Remote work offers flexibility, productivity, and access to global talent, benefiting both companies and individuals. However, AI complicates vetting, pushing companies to innovate in verifying applicant identities and credentials.
However, technologies like Artificial Intelligence (AI) are making vetting difficult for companies during the hiring process. This forces companies to rethink their hiring strategies and find innovative ways to verify the true identities and credentials of their applicants.
KnowBe4, a cybersecurity awareness training company unsuspectingly hired a North Korean spy. The incident highlights critical vulnerabilities in remote recruitment processes and offers valuable lessons for organisations worldwide.
The company said they did their due diligence – after receiving resumes they started with the interview process, did background checks, verified references and the candidate was hired for a remote position.
Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 Africa reiterates that sophisticated technology makes it difficult for companies who are hiring to distinguish between who is real and who is fake.
“Some methods fraudsters use include fake identities and relying on AI images to evade detection. Their motive is usually to gain access to sensitive company data, either for financial gain or to support the North Korean regime.”
If this could happen to a cyber security company it surely raises concerns about the vulnerability of other organisations to such scams.
The candidate is said to have used a stolen US identity and convincingly portrayed themselves as working from the US. They used a virtual private network (VPN) and logged in at night. Despite rigorous background checks and video interviews, the imposter infiltrated the company. The company uncovered the scam when the laptop they provided downloaded malware upon first use.
Collard said, fortunately, KnowBe4’s security measures detected the attempted attack early, and they prevented any data compromise.
The incident gave KnowBe4 a lot to think about and a chance to discuss how they could enhance their hiring process. “For a cyber security company like us to get caught with egg on our face was a big wake-up call,” admits Collard. She further said they could have kept quiet, but instead they shared their story hoping other organisations could learn from it.
As a result, they have implemented several process changes to catch this kind of incident earlier. “For example, in the US, we will only ship new employee workstations to a nearby UPS shop and require a picture ID.”
These are some of the precautious measures suggested by KnowBe4 for HR personnel:
- Inconsistent CV details: Look for discrepancies in birth dates or unexplained gaps in employment history.
- Reference checks: Go beyond email verifications; conduct phone calls to confirm references.
- Overqualification: Be wary of candidates who seem overqualified for the role, as this may be a tactic to avoid scrutiny.
- Camera avoidance: Candidates refusing to appear on camera during interviews should raise suspicion.
- Digital footprint: Conduct thorough background checks, including social media analysis. A “digital ghost” with no online presence is a red flag.
- Multi-factor authentication (MFA): Implement MFA from day one, using hardware tokens sent to verified addresses.
- Secure devices: Provide pre-configured, secure devices to new hires, restricting access to sensitive information until trust is established. Also scan your remote devices to make sure they have not been compromised.
- Limit access: New employees should only be able to access a minimal number of necessary apps to go through the new employee training, and their workstations should be locked down with no data residing on them, except for the company’s endpoint security and management tools.
“Your HR and IT processes need to work in tandem and be watertight when recruiting. By adopting stringent security practices and remaining vigilant, companies can mitigate the risks associated with remote hiring and protect themselves from sophisticated scams,” Collard advises.
She said the wake-up call underscores the importance of continuous improvement in security protocols, even for industry leaders.
“As the digital landscape evolves, so too must our approach to safeguarding our organisations against increasingly cunning threats.”
Share